fix: close input normalization aliases
This commit is contained in:
@@ -60,6 +60,17 @@ describe('content schemas', () => {
|
||||
})).toThrow(/production hostname is not approved/i);
|
||||
});
|
||||
|
||||
it('rejects preview URL normalization aliases instead of accepting their normalized value', () => {
|
||||
for (const canonicalUrl of [
|
||||
'https://portfolio.localhost/.',
|
||||
'https://portfolio.localhost/%2e',
|
||||
'https://portfolio.localhost/?',
|
||||
]) {
|
||||
expect(() => parseSiteConfig({ environment: 'preview', canonicalUrl, buildId: 'preview-1' }))
|
||||
.toThrow(/exactly https:\/\/portfolio\.localhost\//i);
|
||||
}
|
||||
});
|
||||
|
||||
it('rejects controls, non-NFC URLs, and ports at all public URL boundaries', () => {
|
||||
expect(() => parseSiteConfig({
|
||||
environment: 'preview', canonicalUrl: 'https://portfolio.localhost/\n', buildId: 'preview-1',
|
||||
|
||||
Reference in New Issue
Block a user